Re: Stopping Sophie doesn't work very well

"Trey Nolen" <[email protected]> Wed, 10 Mar 2004 08:06:05 -0600
Newsgroups gmane.comp.security.virus.vtools
Message-ID <[email protected]>
> 1 When i try to stop sophie using sophie -stop it won't stop sophie very
> well. Not all daemons are killed of. So i have to do a kill to the
remaining
> daemons. Is there any way around this?? Perhaps this is the problem, when
i
> stop sophie i see this in the output:
>
> Scanning dir    : 'top'
> Error: Could not open dir (top)
>
> Can you guys help me with this


We use daemontools to control Sophie, and it works very well. We also
modified the savget script so that it correctly HUPs sophie using
daemontools when automatic updates are performed.  Daemontools can be found
at http://cr.yp.to/daemontools.html.


>
> 2 I'm having a wierd problem. I have Postfix with amavisd-new SpamAssassin
> and Sophie and it detects virussus very wel but from time to time virusses
> get past the filter and i can't find any record about the entire mail in
the
> amavisd or postfix log. Does this have to do with Sophie??
>

We are calling Sophie with qmail-scanner and have modified the
qmail-scanner-attachments.db to handle the Netskys and Bagles that were
getting through.  We are thinking about adding Clamav as well, but are a
little worried about the extra CPU load of running two virus scanners.

Trey Nolen